Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts… (CVE-2026-74670)

The vulnerability in the Linux kernel IPVS estimator kthread arises because the kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If the network namespace teardown disables IPVS during this phase, ip_vs_est_calc_phase() can return without installing positive limits. Consequently, the kthread continues into its main loop and drains est_temp_list with zero chain_max, tick_max, and est_max_count values. Each enqueue consumes a tick row, but est_count never reaches zero est_max_count, leading to consumption of all rows. After all rows are consumed, a row lookup returns IPVS_EST_NTICKS, causing ip_vs_enqueue_estimator() to write past the bounds of ticks and tick_len arrays, resulting in out-of-bounds memory writes. The patch modifies the kthread to exit after the calculation phase if stopping or disabled, preventing draining with uninitialized limits. Additionally, it manages task references properly to ensure stability during teardown or reload.

This vulnerability allows out-of-bounds writes in kernel memory due to improper handling of IPVS estimator kthread limits during network namespace teardown. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. Exploitation could lead to kernel memory corruption, potentially causing system crashes or privilege escalation. However, there are no known exploits in the wild at this time.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to prevent exploitation. Since this is a kernel-level issue, upgrading to the patched kernel version is the recommended remediation. No additional mitigations are indicated by the vendor advisory.